CVE-2024-53274

Habitica is an open-source habit-building program. Versions prior to 5.28.5 are vulnerable to reflected cross-site scripting. The `register` function in `home.vue` containsa reflected XSS vulnerability due to an incorrect sanitization function. An attacker can specify a malicious `redirectTo` parameter to trigger the vulnerability. Arbitrary javascript can be executed by the attacker in the context of the victim’s session. Version 5.28.5 contains a patch.

• CWE-79

• https://github.com/HabitRPG/habitica/commit/946ade5da1f52a804ef2ba76d49416c43e8166bfPatch
• https://securitylab.github.com/advisories/GHSL-2024-109_GHSL-2024-111_habitica/Exploit, Third Party Advisory

Published

Dec 12, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-53269Envoy is a cloud-native high-performance edge/middle/service…7.5
• CVE-2024-5327The PowerPack Addons for Elementor (Free Widgets, Extensions…5.4
• CVE-2024-53270Envoy is a cloud-native high-performance edge/middle/service…7.5
• CVE-2024-53271Envoy is a cloud-native high-performance edge/middle/service…7.1
• CVE-2024-53272Habitica is an open-source habit-building program. Versions …6.1
• CVE-2024-53273Habitica is an open-source habit-building program. Versions …6.1
• CVE-2024-53275Home-Gallery.org is a self-hosted open-source web gallery to…5.3
• CVE-2024-53276Home-Gallery.org is a self-hosted open-source web gallery to…6.3
• CVE-2024-53277Silverstripe Framework is a PHP framework which powers the S…5.4
• CVE-2024-53278Cross-site scripting vulnerability exists in WP Admin UI Cus…4.8
• CVE-2024-53279Improper neutralization of input during web page generation …5.9
• CVE-2024-5328A Server-Side Request Forgery (SSRF) vulnerability exists in…9.3